just setup fails twice on a clean checkout: SDK build requires npm, lefthook not resolved from Hermit

[nesdeq]

just setup cannot complete on a clean Linux checkout. It fails twice, in two different places, for the same underlying reason: the setup path shells out to binaries that this repo never guarantees are on PATH.

CI does not catch either one, because every CI job runs cashapp/activate-hermit first, which puts the whole pinned toolchain on PATH. A contributor who clones the repo and runs the documented just setup gets neither.

Bug 1: the SDK build requires npm, in a pnpm-only workspace

sdk/package.json defines its build by shelling back out to npm:

"build": "npm run generate && npm run build:ts",

This repo uses pnpm. There is no npm requirement anywhere else in setup, packageManager is pnpm, the lockfile is pnpm-lock.yaml, and the two scripts being delegated to are one-liners (tsx generate-schema.ts and tsc). The npm indirection buys nothing and adds a hard dependency on a package manager the project does not otherwise use.

npm is not on PATH, and it is not in pnpm's script environment either:

$ command -v npm ; echo $?
1

$ cd sdk && pnpm exec bash -c 'command -v npm'; echo $?
1

So just setup dies at _setup-dev-deps with npm: command not found.

Fix: call the underlying commands directly and drop the npm dependency.

"build": "tsx generate-schema.ts && tsc",

(pnpm run generate && pnpm run build:ts would also work if the indirection is wanted, but there is no reason for it here.)

Bug 2: _install-lefthook calls a bare lefthook that only exists under Hermit

With bug 1 worked around, setup gets all the way through the Goose backend build (about 7 minutes) and then dies on the last step:

just _install-lefthook
if [ -d .git ]; then lefthook install --force; else echo "Skipping lefthook install in Git worktree"; fi
sh: line 1: lefthook: command not found
error: recipe `_install-lefthook` failed on line 72 with exit code 127
error: recipe `setup` failed on line 83 with exit code 127

lefthook is not a pnpm dependency. It is a Hermit package, and the repo already tracks the shim at bin/lefthook (-> .lefthook-2.1.6.pkg -> hermit). The recipe just never looks there, so it only resolves for someone who has already sourced bin/activate-hermit.

Losing a 7 minute build to a hook installer is a bad failure ordering on its own, but the recipe should simply use the shim the repo ships.

Fix: resolve the pinned shim, fall back to PATH, and fail with a message that says what to do.

[unix]
_install-lefthook:
    #!/usr/bin/env bash
    set -euo pipefail
    if [ ! -d .git ]; then
        echo "Skipping lefthook install in Git worktree"
        exit 0
    fi
    # Prefer the Hermit-pinned shim so setup works without activating the env.
    if [ -x ./bin/lefthook ]; then
        ./bin/lefthook install --force
    elif command -v lefthook >/dev/null 2>&1; then
        lefthook install --force
    else
        echo "lefthook not found. Activate Hermit (source ./bin/activate-hermit) or install lefthook." >&2
        exit 1
    fi

Verified: with this applied, just setup completes and installs both hooks.

just _install-lefthook
sync hooks: ✔️ (pre-commit, pre-push)

The worktree branch is preserved, since [ -d .git ] is still false in a worktree.

Out of scope

The npm ci in src-tauri/src/services/managed_acp_tools.rs is not part of this. That one runs against the Berd-managed Node runtime, which supplies its own node/npm, so it is properly self-contained. No change wanted there.

Root cause

Both bugs are the same class: setup assumes an ambient toolchain instead of using what the repo pins. Worth deciding explicitly which posture setup takes:

1. Setup is self-sufficient and resolves repo-pinned tooling itself (what the fix above does), or
2. Hermit activation is a hard prerequisite, in which case setup should check for it up front and fail immediately with a clear message rather than 7 minutes in.

Either is defensible. Silently depending on it is not. If (2) is the intent, README/CONTRIBUTING should say so, since neither currently mentions Hermit or activate-hermit at all.

Environment

commit	b621258f
os	Linux 7.1.8-1-cachyos
just	1.58.0
pnpm	10.33.0
node	v26.7.0
npm	not installed